MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 488b702c476f32b610d2d49d6da776ea149baadc2841dedaef8b01ffb3543371. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 488b702c476f32b610d2d49d6da776ea149baadc2841dedaef8b01ffb3543371
SHA3-384 hash: bf3b9c601ecb231b9a9201673806c77044d82be069c1ba7b0280e0492362ac4b701d70dbf7ee661e7972f928110f6be7
SHA1 hash: 268c9ca1179117410b2d29d05c586fc304e20375
MD5 hash: 9919b43e5cace52639ca1094992da417
humanhash: diet-texas-mountain-enemy
File name:REG PO 483900029.r11
Download: download sample
Signature AgentTesla
Create hunting rule
File size:379'174 bytes
First seen:2020-06-29 06:08:09 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:VIrxllbfMZ6h0bTaO6i/Je/TLkOJIG0L0O7jVTekpJQNfsQ6esTTpckG:VINltOy6TadsUTLkOJIGF6jZCsqkckG
TLSH 2984234BD92864DA82D422C485C88D4CA48799C31F3CF80F4936DD6A477FE7866D4EBE
Reporter abuse_ch
Tags:AgentTesla r11


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: kfc.aw
Sending IP: 37.49.224.170
From: N.Paulraj <payables@kfc.aw>
Subject: Premier spg & wvg mills pvt ltd
Attachment: REG PO 483900029.r11 (contains "REG PO 483900029.exe")

AgentTesla SMTP exfil server:
smtp.chaikistomato.us:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/488b702c476f32b610d2d49d6da776ea149baadc2841dedaef8b01ffb3543371/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-29 06:10:06 UTC
AV detection:
21 of 31 (67.74%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jcfxalchn4zlmegs2sow3j3w5ikjxkw4fba55wxprma77m2ugnyq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 488b702c476f32b610d2d49d6da776ea149baadc2841dedaef8b01ffb3543371

(this sample)

AgentTesla

Executable exe 81f0bf1ca5237ca0681c70e229cbd46307bdcf8d67e20ad0f328973921d7480d

  
Dropping
MD5 dafd7a7466f2397cc2183057642172f9
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 81f0bf1ca5237ca0681c70e229cbd46307bdcf8d67e20ad0f328973921d7480d

Comments